The best way for external researchers to figure out who's getting the short end of the stick online is to create lots of different profiles on a site, with a range of different genders, races, and ages. But because of a law that dates back to 1986, that is technically illegal.

Advertisement

So, on Wednesday, the ACLU announced that it's filing a lawsuit against the federal government claiming the 1986 anti-hacking law, which technically makes it illegal not to comply with a company's terms of service, violates the First Amendment rights of academic researchers and journalists.

The lawsuit, Sandvig v. Lynch, filed in the U.S. District Court for the District of Columbia, takes aim at a section of the Computer Fraud and Abuse Act (CFAA) that criminalizes "exceeding authorized access" on a computer to obtain "information from any protected computer."

The ACLU explains on its blog that courts have interpreted this as criminalizing violations of the Terms of Service that govern user relationships with the websites they visit. So if a researcher or journalist wants to perform research by, for example, setting up accounts under false names and using photos of others in order to test whether a service is discriminating on race, that could be considered illegal. Similar concerns have alsobeen raised in the past about security research, but the ACLU's current suit focuses on research on discrimination.

Advertisement

The ACLU is bringing the suit on behalf of four academic researchers, including Christian Sandvig, the University of Michigan professor who the case takes its name from, and the journalism organization First Look Media.

The lawsuit isn't in response to any particular trouble a researcher has gotten into for doing this kind of research. But it claims that researchers are holding back from doing beneficial work because it's technically illegal. Sandvig and another plaintiff, Kyratso Karahalios, are hoping to research discrimination on real estate websites by setting up profiles as various people of different races and seeing how that affects the listings shown to them by the website offers. The two other researcher plaintiffs, Alan Mislove and Christopher Wilson, hope to research how race is used as a factor for ranking candidates on hiring sites. First Look Media, which owns The Intercept, would like to scrape data as part of its investigations. All of those practices could be prosecuted under the CFAA.

The ACLU is right that the CFAA, and certainly the section of the law, has been repeatedly misread and abused. You can chalk that up to a litany of causes, including judges with a poor understanding of technology and, as the ACLU notes, corporations whose financial interests are best served by not having outside research on their practices conducted. Take Airbnb, which has had to answer questions about its racism problems, which have been documented in part throughexternal,academic research involving the creation of fake profiles.

Whether this particular case will succeed, though, is kind of a dicey question. The suit relies on yet-to-be conducted research plans laid out by researchers, and a judge may see it as a publicity stunt and throw it away. The ACLU even says that this lawsuit is "the first step in this fight." But the reality is it'll likely be the first of many steps.

Advertisement

Ethan Chiel is a reporter for Fusion, writing mostly about the internet and technology. You can (and should) email him at ethan.chiel@fusion.net